azure - Terraform:创建 Azure 策略(允许的位置)- 缺少值

Question

我遇到了以下错误消息，但我无法确定我错过了什么。

错误:创建范围策略分配(范围:“/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx”│ 策略分配名称:“允许的位置”):意外状态 400，错误:PolicyParametersMissingValue:策略参数“listOfAllowedLocations”缺少值。

下面是我的 Terraform 代码。

provider "azurerm" {
  features {}
  }

  terraform {
  required_providers {
      azurerm = {
          source = "hashicorp/azurerm"
          version = ">= 2.96.0"
      }
  }
  }

  resource "azurerm_subscription_policy_assignment" "Allowedlocations2" {
    name = "Allowed locations"
    subscription_id = var.cust_scope
    policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c"
    description = "This policy enables you to restrict the locations your organization can specify when deploying resources."
    display_name = "Allowed locations"
    metadata = <<METADATA
      {
      "category": "General"
      }
METADATA


    parameters = <<PARAMETERS
      {
          "listOfAllowedLocations": {
            "type": "Array",
            "metadata": {
              "description": "The list of locations that can be specified when deploying resources.",
              "strongType": "location",
              "displayName": "Allowed locations",
              "strongType": "location"
            },
            "defaultValue": [
              "eastus"
            ],
            "allowedValues": [
              "eastus",
              "eastus2"
            ]
          }
        }
PARAMETERS

  }

作为 Terraform 初学者，我错过了一个值，但我无法找到它。如果有人知道它是什么以及如何找到它，请告诉我。

azurerm_subscription_policy_assignment.Allowedlocations2: Creating...
╷
│ Error: creating Scoped Policy Assignment (Scope: "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
│ Policy Assignment Name: "Allowed locations"): unexpected status 400 with error: **PolicyParametersMissingValue: The policy parameters 'listOfAllowedLocations' are missing a value.**
│
│   with azurerm_subscription_policy_assignment.Allowedlocations2,
│   on main.tf line 65, in resource "azurerm_subscription_policy_assignment" "Allowedlocations2":
│   65:   resource "azurerm_subscription_policy_assignment" "Allowedlocations2" {
│
│ creating Scoped Policy Assignment (Scope: "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
│ Policy Assignment Name: "Allowed locations"): unexpected status 400 with error: PolicyParametersMissingValue: The policy parameters 'listOfAllowedLocations' are missing a value.
╵

Answer 1

Error: creating Scoped Policy Assignment (Scope:"/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" │ Policy Assignment Name: "Allowed locations"): unexpected status 400 with error: PolicyParametersMissingValue: The policy parameters'listOfAllowedLocations' are missing a value.

上述错误消息的原因表明您的策略分配中缺少 listOfAllowedLocations 参数的值。您似乎错误地定义了 parameters block 。

当我尝试在没有 listOfAllowedLocations 的情况下以错误的格式传递它时，我也会遇到与您相同的错误。

这是用于创建策略定义和分配的更新 Terraform 代码。

provider "azurerm" {
  features {}
}

data "azurerm_subscription" "current" {}

data "azurerm_policy_definition" "example" {
  display_name = "Allowed locations"
}

output "id" {
  value = data.azurerm_policy_definition.example.id
}

resource "azurerm_subscription_policy_assignment" "example" {
  name                 = "Allowed Locations Policy-1"
  policy_definition_id = data.azurerm_policy_definition.example.id
  subscription_id      = data.azurerm_subscription.current.id

  parameters = jsonencode({
    listOfAllowedLocations = {
      value = ["eastus", "westus"]
    }
  })
}

Terraform 应用:

运行后，上述代码策略将分配给订阅范围，如下所示。